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I. REAL PARTY IN INTEREST 

The real parties in interest are the inventors Kathy Maida-Snnith of 
Houston, Texas and Steven W. Engle of Garland, Texas, and the MetaSecure 
Corporation, a Texas Corporation, having its principal place of business in 
Houston, Texas, which is owned and operated by Kathy Maida-Smith. 



2231 77.01 /241 6-00300 



Page 3 of 32 



Appl. No. 10/804,775 

Appeal Brief dated March 12, 2008 

Reply to Final Office Action of September 18, 2007 



II. RELATED APPEALS AND INTERFERENCES 

Appellants are unaware of any related appeals or interferences. 
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III. STATUS OF THE CLAIMS 

Originally filed claims: 1 -26. 
Added claims: None. 
Claim cancellations: None. 
Presently pending claims: 1 -26. 
Presently appealed claims: 1 -26. 
Presently allowed claims: None. 
Presently objected claims: None. 
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IV. STATUS OF THE AMENDMENTS 

There were no amendments filed subsequent to the final Office Action of 
September 1 8, 2007 (hereinafter "Office Action"). 
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V- SUMMARY OF THE CLAIMED SUBJECT MATTER 

Operators of networks that provide access to resources outside their 
network {e.g., access to the Internet) utilize a number of different network 
components that collect security data or perform other functions to safeguard 
the systems attached to the network maintained by the operators. Specification 
of the subject application as published (U.S. Pat. App. Pub. No. 2004/0205356, 
hereinafter "Specification"), p. 1, lines 1-12 of H [0003]. But collecting and 
storing such information for later analysis can be difficult, due to differences in 
the organization and format of the data used by each component. Specification, 
p. 1, lines 1-7 of H [0005]. If, due to these difficulties, the operator decides not 
to store the information, the data needed to later confirm a confidentiality, 
integrity or availability problem within the network will not be available. 
Specification, p. 1, lines 7-9 of H [0005]. Even when such data is stored and 
available to reconstruct an event from a relevant time period, the data from each 
component is typically analyzed separately. Analysis of even the data from a 
single component may be complicated further if an upgrade of the component 
results in a change in the format of the component's data. Specification, p. 1, 
lines 9-14 of H [0005]. The generation and use of metadata-based scripts to 
parse differently-organized and formatted data into records having a consistent 
labeling and access structure, and the maintenance of consistent labeling and 
structuring of the parsed data (independent of later changes in the organization 
and format of the source data) is the subject of Appellants technological 
contribution. 

In accordance with the invention of independent claim 1 , for example, a 
method for compiling parser scripts (each corresponding to the structure of 
security data received from a network component) is described (p. 1 , lines 1-3 of 
% [0009]; p. 3, lines 1-4 of H [0039]; and Figure 2), which includes identifying sets 
of data categories (each set corresponding to security data received from one of 
a plurality of network components) (p. 1, lines 3-5 of H [0009]; p. 2, lines 6-10 of 
1|[0025]; and Figure 2), and constructing database record definitions (each 
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defining a record subdivided in accordance with one of the sets of data 
categories) (p. 1, lines 5-7 of H [0009]; p. 2, lines 18-21 of H [0025] and lines 1-5 
of H [0026] (describing a meta-database); p. 3, lines 1-8 of H [0030]; and Figure 
2). The method further includes writing parser scripts that receive security data 
from the network components and output records (each record corresponding to 
one of the record definitions), and storing the parser scripts (p. 1, lines 7-10 of 
If [0009]; p. 3, lines 1 -6 of If [0039]; and Figure 2). 

In accordance with the invention of independent claim 7, for example, an 
information network security data compilation system is described that includes a 
first network component, a second network component, and a data parser 
coupled to the first and second network components (p. 1, lines 1-6 of If [0010]; 
p. 4, lines 1-21 of If [0043]; and Figure 3). The data parser has access to a first 
parser script and a second parser script. The data parser is operable to produce 
categorized data from the data received from the first and second network 
component's data interface operating with the first and second parser scripts, 
respectively (p. 1 , lines 6-8 of If [0010]; pp. 3-4, lines 1-18 of If [0040]; lines 1-5 of 
If [0045]; and Figures 2 and 3). 

In accordance with the invention of independent claim 19, for example, a 
method of compiling network security data is described that includes collecting 
security data from a plurality of network components, and accessing a plurality of 
different parser scripts (each script corresponding to one of the network 
components) (p. 1 , lines 1-5 of If [001 1]; p. 3, lines 1-3 of If [0040]; and Figures 2 
and 3). The method further includes applying the plurality of different parser 
scripts to the security data to produce categorized and formatted data, and 
storing the categorized and formatted data to a central data manager comprising 
a data storage device (p. 1 , lines 5-6 of If [001 1]; pp. 3-4, lines 1-18 of If [0040]; 
lines 1-5 of If [0045]; and Figures 2 and 3). 
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VI. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

• Whether claims 14 and 19-26 are directed to unpatentable subject 
matter under 35 U.S.C. §101. 

• Whether claims 1-26 are unpatentable over Kouchi et al. (U.S. Pat. No. 
6,023,694, hereinafter "Kouchi") in view of Kennelly et al. (U.S. Pat. No. 
6,101,539, hereinafter "Kennelly") under 35 U.S.C. § 103(a). 
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VII. ARGUMENT 

A- Overview of Kouchi 

Kouchi is directed to the generation of output or reports about information 
contained within a data source. The information may be any of two or more 
types of source data, and the output or reports are generated in a standardized 
or uniform manner. Kouchi, lines 1-4 of the Abstract. Drivers are provided that 
are specific to different types of source data. The drivers identify structural or 
other characteristics of the data sources. Kouchi, lines 4-7 of the Abstract. 
Kouchi teaches the conversion of one or more sources into one or more uniform 
databases (Kouchi, lines 10-12 of the Abstract), and the creation of one or more 
databases which have a degree of uniformity of structure (Kouchi, lines 15-17 of 
the Abstract). The different data sources are automatically analyzed to identify 
and/or create categories of data used to organize the databases. Kouchi, lines 
19-21 of the Abstract. 

Appellants respectfully note that Kouchi teaches the use of the 
aforementioned drivers, but does not discuss how the drivers are created or 
generated. Kouchi merely describes the drivers as "processes having multiple 
functions for analyzing and accessing different types of source data" (Kouchi, 
col. 9, lines 40-41)", noting that, "In one embodiment, the function modules 804 
are provided as dynamic link libraries (DLLs)..." (Kouchi, col. 9, lines 42-43). 
Kouchi also teaches that "it would also be possible to make an operable version 
of the invention in which the function performed by the function modules are 
provided as portions of or subroutines called by the main procedure 802 rather 
than being separately stored modules." Kouchi, col. 22, lines 61-65. Appellants 
respectfully submit that one of ordinary skill in the art would thus understand the 
drivers taught by Kouchi to be pre-existing executable programs, not scripts 
created using any of the teachings of Kouchi, and further requiring interpretation 
by a parser. 
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Appellants also respectfully note that Kouchi teaches drivers that generate 

a database based upon data definitions that are then stored by the drivers in the 

database created by the drivers. Specifically, Kouchi teaches that, 

The main procedure 802 also calls or activates a function 904 of the 
appropriate driver or modules 804 to load data definitions 1024. Data 
definition can include information such as the text name stored as an 
identifier for a particular class or category of data in the data source 
806, the field size, type of data (string, integer or decimal; number of 
decimal places) and similar characteristics for various categories of 
data. Preferably, loading of the data definition includes interrogation 
of the data to obtain information necessary to store an indication of 
the architecture or structure of the information in the data source and 
the data elements in the data source as required to generate one or 
more new databases 808 which will contain all of the structure and 
data needed for the type of reporting or analysis to be performed on 
the new database.... In general, steps of loading data or information 
1022, 1024, 1033, 1036 are performed by functions in drivers 804, 
while steps of saving information 1026, 1028, 1030, 1032, 1034, 
1 038 are performed by the main process 802. 

Kouchi, col. 16, lines 64-67 through col. 17, lines 1-11, and col. 17, lines 29-33 
(emphasis added). The cited passage teaches loading and storing data 
definition information as part of the process of generating a database that 
includes both the data definition information and the data. Because the process 
of generating the database is performed by the driver, the driver must already 
exist before the database can be generated, and before data definition 
information can be stored in the database by the driver. 
B. Overview of Kennelly 

Kennelly is directed to computer code executing on a network packet 
switch that produces management objects used to configure the switch. 
Kennelly, col. 1 , lines 39-43. The switch accepts an interface request from a 
user and establishes a request processor that parses data files, based on 
attributes associated with the requesting user, to construct a set of management 
objects. Kennelly, col. 1 , lines 43-48. More specifically, database management 
software allows a user {e.g., an administrator) to remotely configure a switch via 
a graphical user interface (GUI). The GUI is presented to the user by a web 
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browser that interfaces with the database management software {e.g., using 
hypertext markup language (HTML) based web pages). Kennelly, col. 3, lines 
7-17. A scripting parser within the database management software (Kennelly, 
Fig. 2) receives an embedded script from an HTML page and parses the script 
into methods that can retrieve objects (Kennelly, col. 6, lines 43-46). An object 
manager, also within the database management software, translates operations 
by the scripting parser into queries for particular information within objects that 
are accessible by the object manager. Kennelly, col. 4, lines 8-14, and Fig. 2. 
The object manager determines whether the requested object is accessible 
either from the operating system of the database server, or from the database. 
Kennelly, col. 6, lines 52-54, and Fig. 2. The object manager maps entries 
matching the queries back into manager objects. Kennelly, col. 7, lines 3-4. 
The manager objects that are returned are combined by the scripting parser 
with HTML to complete the web page presented on the browser. Kennelly, 
col. 7, lines 4-6. 

Appellants respectfully note that the output generated by the scripts of 
Kennelly, based upon the data retrieved, is only described as HTML that is used 
by the browser. See Kennelly, col. 6, lines 34-39; col. 7, lines 4-6; and col. 12, 
lines 47-55. The output of the parser taught by Kennelly does not include 
database records that each conform to a corresponding database record 
definition. 

C. The § 101 Rejections of Claims 14 and 19-26 

1. The § 101 Rejection of Dependent Claim 14 

Appellants respectfully note that in rejecting dependent claim 14, the 
Examiner stated that "Applicant recites conditional limitations for producing 
results, such as the claimed, *if the data matches...' such that the condition is not 
met, the claims will generate no useful, concrete, and tangible results." Office 
Action, p. 4, 3''*^ paragraph through p. 5. Thus, the Examiner appears to be 
arguing that because the dependent claim recites an element that allegedly 
conditionally performs a task, the entire claim is, on its face, directed to non- 
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statutory subject matter. Appellants respectfully traverse this assertion by the 
Examiner, and respectfully note that "[c]laims in dependent form shall be 
construed to include all the limitations of the claim incorporated by reference into 
the dependent claim." 37 CFR § 1.75(c). Thus, claim 14, which depends upon 
independent claim 7, includes all of the limitations of claim 7. 

Since the Examiner did not reject claim 7 as directed to non-statutory 
subject matter, Appellants respectfully assume that the Examiner implicitly 
acknowledges that independent claim 7 is directed to statutory subject matter, 
and does produce useful, concrete, and tangible results. Therefore, given that 
claim 14 includes all of the limitations of claim 7, and given that claim 7 produces 
useful, concrete and tangible results, the conditional nature of claim 14 is 
irrelevant. Regardless of whether "the event detector... provides a signal if a 
match is found," as required by claim 14, the system of dependent claim 14 will 
still include all of the elements of independent claim 7 and will still produce the 
same useful, concrete and tangible results as independent claim 7. Appellants 
thus respectfully submit that for at least these reasons, dependent claim 14 is 
directed to statutory subject matter. 

Appellants further respectfully note that the recitation of a conditional claim 
limitation does not automatically mean that a claim is directed to non-statutory 
subject matter for failing to produce tangible, concrete, and useful result when the 
condition is not met. The condition itself is a limitation of the claim, and thus the 
invention as claimed does in fact produce a tangible, concrete and useful result, 
as long as the result produced when the condition is met is tangible, concrete and 
useful. Appellants are unaware of any requirement in the statute, rules, or MPEP 
that the unclaimed inverse of a limitation must produce a tangible, concrete and 
useful result in order for the claim to be directed to statutory subject matter. For 
at least these reasons. Appellants respectfully submit that dependent claim 14 
does not fail to produce tangible, concrete, and useful results simply because it 
recites a conditional limitation, and thus further respectfully submit that the 
rejection of the claim on this basis is improper. 
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Appellants also respectfully note that the requirement that an invention 

produce a "useful, concrete and tangible result," is only a requirement of a 

claimed invention that is directed to a practical application of a 35 U.S.C. § 101 

judicial exception. Specifically, 

A claimed invention is directed to a practical application of a 35 
U.S.C. 101 judicial exception when it: 

(A) "transforms" an article or physical object to a different state or 
thing; or 

(B) otherwise produces a useful, concrete and tangible result , 
based on the factors discussed below. 

MPEP, §2106-IV-C-2 (emphasis added). The judicial exceptions, which are 

otherwise considered non-statutory subject matter, include laws of nature, 

natural phenomena and abstract ideas. See MPEP, §2106-IV-C. Appellants 

respectfully note that the Examiner did not allege that claim 14 is directed to an 

application of a judicial exception to § 101. Appellants thus respectfully submit 

that, for at least these reasons, the Examiner's application of the "useful, 

concrete and tangible result" standard to dependent claim 14 is improper.'' 

Additionally, Appellants respectfully note that, "The burden is on the 

USPTO to set forth a prima facie case of unpatentability. Therefore if USPTO 

personnel determine that it is more likely than not that the claimed subject 

matter falls outside all of the statutory categories, thev must provide an 

explanation ." IVIPEP, §2106-IV-B (emphasis added). Appellants respectfully 

submit that the Examiner has failed to explain whether it is believed that the 

claimed invention of claim 14 is directed to an application of one of the judicial 

exceptions to § 101, and if so, which exception and why. Appellants therefore 

respectfully submit that for at least these reasons, the Examiner, in applying the 

"useful, concrete and tangible result standard" to dependent claim 14, has also 

failed to meet the required burden to establish a prima facie case of 

unpatentability of the claim. 

^ Appellants further respectfully note that if the Examiner is attempting to raise an issue as to the 
utility of the claimed invention, a different standard and analysis applies. See MPEP 
§2107-2107.03. 
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Appellants further respectfully note that claim 14 is directed to an 
apparatus (a data compilation system), which falls at least within the "machine" 
category of the four enumerated categories of patentable subject matter recited 
in 35 U.S.C. § 101 {i.e., process, machine, manufacture, or composition of 
matter). The claim limitations are at least directed to elements of a data 
compilation system {e.g., an event detector), to elements which are manipulated 
by the elements of the data compilation system {e.g., the categorized data), and 
to operations performed by elements of the data compilation system {e.g., 
comparing the categorized data to a predetermined event and providing a signal 
if a match is found). While some of these limitations might be characterized as 
functional limitations, such limitations, if truly functional, would still not alter the 
fact that the claim is directed to an apparatus, and thus directed to an invention 
within one of the enumerated subject matter categories of § 101. See MPEP, 
§ 2106-IV-B ("Note that an apparatus claim with process steps is not classified 
as a 'hybrid' claim; instead, it is simply an apparatus claim including functional 
limitations.") (emphasis added). Appellants thus respectfully submit that the 
limitations of dependent claim 14 are directed to a properly claimed apparatus, 
and that the claimed apparatus falls within at least one of the enumerated 
statutory subject matter categories of 35 U.S.C. §101. 

For at least these reasons. Appellants respectfully submit that the 
Examiner's rejection of dependent claim 14 is improper, that the rejection is not 
properly explained and supported, and that dependent claim 14 properly claims 
an apparatus that is within at least one of the enumerated statutory subject matter 
categories of § 101. 

For at least the reasons presented above. Appellants respectfully submit 
that the Examiner erred in rejecting dependent claim 14 under 35 U.S.C. § 101, 
and thus respectfully request reversal of the rejection of this claim. 

2. The § 101 Rejection of Independent Claim 19 

Regarding the rejection of Independent claim 19, Appellants respectfully 
note that the Examiner rejected this claims on similar grounds as those 
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presented with regard to dependent claim 14. Appellants thus respectfully 
submit, for at least the same reasons as those presented above with regard to 
dependent claim 14, that: 

• claim 19 does not fail to produce tangible, concrete, and useful 
results simply because it recites a conditional limitation, and thus 
the rejection of the claim on this basis is improper; 

• the Examiner did not allege that claim 19 is directed to an 
application of a judicial exception to § 1 01 , and thus the Examiner's 
application of the "useful, concrete and tangible result" standard to 
claim 19 is improper; and 

• the Examiner has failed to explain whether it is believed that the 
claimed invention of claim 19 is directed to an application of one of 
the judicial exceptions to § 101 (and if so, which exception and 
why), and thus, in applying the "useful, concrete and tangible result 
standard" to claim 19, the Examiner has also failed to meet the 
required burden to establish a prima facie case of unpatentability of 
the claim. 

Appellants further respectfully note that under MPEP §2106.01, "'func- 
tional descriptive material' consists of data structures and computer programs 
which impart functionality when employed as a computer component. (The defi- 
nition of 'data structure' is 'a physical or logical relationship among data elements, 
designed to support specific data manipulation functions.' The New IEEE 
Standard Dictionary of Electrical and Electronics Terms 308 (5th ed. 1993).)." 
The MPEP further states that: 

When functional descriptive material is recorded on some 
computer-readable medium, it becomes structurally and functionally 
interrelated to the medium and will be statutory in most cases since 
use of technology permits the function of the descriptive material to 
be realized. Compare In re Lowry, 32 F.3d 1579, 1583-84, 32 
USPQ2d 1031, 1035 (Fed. Cir. 1994)(discussing patentable weight 
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of data structure limitations in the context of a statutory claim to a 
data structure stored on a computer readable medium that 
increases computer efficiency) and Warmerdam, 33 F.3d at 1360- 
61, 31 USPQ2d at 1759 ( claim to computer having a specific data 
structure stored in memory held statutory product-bv-process claim ) 
with Warmerdam, 33 F.3d at 1361, 31 USPQ2d at 1760 (claim to a 
data structure perse held nonstatutory). 
MPEP § 2106.01 (emphasis added). Appellants respectfully submit that at least 
because independent claim 19 requires "storing the categorized and formatted 
data to a central data manager comprising a data storage device," the claim is 
directed to statutory subject matter. 

For at least the reasons presented above, Appellants respectfully submit 
that the Examiner erred in rejecting independent claim 19 under 35 U.S.C. § 101 , 
and thus respectfully request reversal of the rejection of this claim. 

3. The § 101 Rejections of Dependent Claims 20-26 
Regarding dependent claims 20-26, Appellants respectfully note that 
these claims, which all depend upon independent claim 19, were rejected by the 
Examiner on the same grounds as claim 19. Thus, for at least the same 
reasons as those presented above with regard to independent claim 19, 
Appellants respectfully submit that the Examiner erred in rejecting dependent 
claims 20-26 under 35 U.S.C. § 101, and thus respectfully request reversal of 
the rejection of these claims. 

D. The § 103(a) Rejections of Claims 1-26 

1. The § 103(a) Rejection of Independent Claim 1 
In rejecting independent claim 1 as allegedly obvious over Kouchi in view 
of Kennelly, the Examiner stated that Kouchi teaches, among other things, 
"constructing database record definitions, each defining a record subdivided in 
accordance with one of the sets of data categories (col 16, lines 64-67 to col 17, 
lines 1-5)." Office Action, p. 6, 2^^ paragraph. The Examiner acknowledged 
that "Kouchi does not expressly teach writing parser scripts that receive security 
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data from the network components and output records, each record 
corresponding to one of the record definitions and storing said parser scripts" 
(Office Action, p. 6, 3'''^ paragraph), but alleged that these claim limitations are 
taught by Kennelly at col 6, lines 40-56 of the reference (Office Action, p. 6, 4*"^ 
paragraph). 

Appellants respectfully traverse the Examiner's characterization of 
Kouchi, noting that the drivers taught by Kouchi are described as executable 
programs (Kouchi, col. 9, lines 42-43, and col. 22, lines 61-65) that load the data 
definitions taught (Kouchi, col. 16, lines 64-66), and thus these data definitions 
already exist and are not constructed by the system taught by Kouchi, as 
required by independent claim 1. Nonetheless, even if, for the sake of 
argument, the act of loading the data definitions were to be construed as 
"constructing" the data definitions taught by Kouchi, the drivers must already 
exist prior to the load operation in order to so "construct" the data definitions. 
But in order to write parser scripts that output records such that each record 
output by the script "corresponds" to one of the record definitions, as required by 
claim 1 , the database record definition must exist before the parser scripts are 
written. 

Appellants respectfully submit that one of ordinary skill in the art would 
understand that a record that corresponds to a record definition is a record that 
has a structure that is "subdivided in accordance with one of the sets of data 
categories," as required by claim 1 . In order for the parser script of claim 1 to 
generate such records, the script must be written so as to output records that 
match the structure described by the record definition. However, logically a 
definition record must first exist in order for there to be a basis upon which to 
generate a script that outputs records structured in accordance with such a 
definition record. Thus, the database record definitions must be constructed 
first, and then the scripts written such that they are capable of outputting records 
that each corresponds to one of the now constructed database record 
definitions. See Specification, p. 3, lines 1-6 of H [0039] ("Once the global 
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database tables have been built, parser scripts can be produced for each output 
of a network component for which there is attribute data in the instanciated 
database. The flat file table and fixed form tables of FIG. 7, from the 
un instanciated mete-data, contain parameters from which a parser script can be 
prepared."), and p. 5, lines 1-4 of f [0057] ("The records in the stream type tables 
include the formatting information that identifies the element in the stream. That 
information is used to create the parsing scripts discussed in prior figures."). 

Appellants further respectfully submit that implying the order of these two 
steps is proper under the circumstances and not an improper importation of 
limitations from the specification. The Federal Circuit, in Altiris Inc. v. Symantec 
Corp. (318 F.3d 1363, 1371, (Fed. Cir. 2003)), held that although the 
specification in that case discussed only a single embodiment, it was improper to 
read a specific order of steps into method claims where, as a matter of logic or 
grammar, the language of the method claims did not impose a specific order on 
the performance of the method steps, and the specification did not directly or 
implicitly require a particular order. IVIPEP §2111.01-11 (emphasis added). 
Appellants respectfully submit that the logical inverse implication of this holding 
is that it is proper to imply order in the steps of a method where, as a matter of 
logic or grammar, the language of the claims does impose a specific order on 
the performance or the specification does directly or implicitly require a 
particular order. Appellants further respectfully submit that while such an 
implication may be supported by either the claims or the specification of the 
subject application, both independent claim 1 and the specification of the 
subject application support such an implication in this case. 

For at least these reasons. Appellants respectfully submit that Kouchi 
does not teach or even suggest constructing database definition records, and 
further that even if the loading of definitions were construed to describe the 
construction of such records, such an alleged "construction" of the definition 
records as taught by Kouchi does not precede the writing of the script, as one of 
ordinary skill in the art would logically understand the language of independent 
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claim 1 to require, in light of the specification. Further, none of the cited art, either 
alone or together, overcomes the deficiencies of Kouchi. 

Appellants further respectfully traverse the Examiner's characterization of 
the Kennelly reference, noting that Kennelly does not teach or even suggest 
"writing parser scripts that receive security data from the network components 
and output records, each record corresponding to one of the record definitions," 
as also required by independent claim 1 . The scripts taught by Kennelly cause 
queries for data from a database to be initiated (Kennelly, col. 6, lines 43-46), 
and further combine any data received together with HTML code to generate web 
pages presented to a user via a web browser (Kennelly, col. 7, lines 4-6). 
Nowhere within the text cited by the Examiner, nor anywhere else within 
Kennelly, is there a teaching or even a suggestion of database records being 
output by the scripts taught by Kennelly, much less scripts that output records 
that each correspond to a record definition. Further, none of the cited art, either 
alone or together, overcomes the deficiencies of Kennelly. 

For at least the reasons presented above. Appellants respectfully submit 
that none of the cited art, either alone or together, teaches or even suggests all of 
the limitations of independent claim 1 , and thus the claim is not rendered obvious 
over the cited art. Appellants therefore respectfully submit that the Examiner 
erred in rejecting independent claim 1 under 35 U.S.C. § 103(a), and respectfully 
request reversal of the rejection of the claim. 

2. The § 103(a) Rejections of Dependent Claims 2-6 

Regarding the rejection of dependent claims 2-6 as also allegedly obvious 
over Kouchi in view of Kennelly, Appellants respectfully note that because these 
claims include all of the limitations of, and depend upon, independent claim 1 , 
and because none of the cited art, either alone or in conjunction with each other, 
teaches or even suggest all of the limitations of claim 1 , for at least the reasons 
presented above with regard to independent claim 1, dependent claims 2-6 are 
also not rendered obvious over the cited art. Appellants therefore respectfully 
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submit that the Examiner erred in rejecting dependent claims 2-6 under 35 U.S.C. 
§ 103(a), and respectfully request reversal of the rejection of these claims. 

Regarding dependent claim 3, the Examiner rejected this claim alleging 
that "Kennelly teaches inserting parser scripts into tables...." Office Action, p. 7, 
3^^ paragraph. While Appellants respectfully traverse the Examiner's 
characterization of Kennelly, Appellants respectfully note that whether Kennelly 
teaches inserting parser scripts into tables is irrelevant. Claim 3 does not 
require inserting scripts into table, but instead requires "inserting output records 
received from the parser scripts into the tables" (emphasis added). Claim 1 , upon 
which claim 3 depends, requires a parser script that outputs records, and it is 
these records that are inserted into the "database tables in a relational database" 
of claim 3. Appellants respectfully note that as already discussed with regard to 
independent claim 1, the scripts taught by Kennelly merely generate output that 
is merged with HTML code to produce a web page displayed to a user by a web 
browser. The scripts taught by Kennelly do not teach or even suggest 
outputting records, let alone inserting such records into a relational database 
table. For at least these reasons, and in addition to the reasons provided with 
regard to dependent claims 2-6, Appellants respectfully submit that none of the 
cited art teaches or even suggests all of the limitations of dependent claim 3, 
either alone or together, and thus do not render the claim obvious. Appellants 
further respectfully submit that dependent claim 4 includes limitations similar to 
those of claim 3, and is therefore also not obvious over the cited art for at least 
the same reasons as claim 3. Appellants thus respectfully submit that at least 
for these additional reasons, the Examiner erred in rejecting dependent claims 3 
and 4 under 35 U.S.C. § 103(a), and respectfully request reversal of the rejection 
of these claims. 

Regarding the rejection of dependent claim 6, while acknowledging that 
Kouchi does not expressly teach a management information base, the Examiner 
alleged that "Kennelly teaches Management Information Base (MIB) (see 
publication listings)." Office Action, p. 7, 5*'^ paragraph. Appellants respectfully 
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note that the listed publication relied upon by the Examiner is not incorporated by 
reference within Kennelly, and thus its contents are not part of the specification. 
Appellants thus respectfully submit that regardless of what the listed publication 
teaches, it is not part of the teaching of Kennelly, and reliance by the Examiner on 
such a publication is improper. Appellants further respectfully submit that 
dependent claim 6 requires "wherein: at least one of the sets of data categories is 
identified, at least in part, by applying a Management Information Base (MIB) 
integrator to a Management Information Base for the corresponding network 
component." Assuming, for the sake of argument, that the title of a listed 
publication operates as a properly cited prior art reference (which Appellants 
emphatically assert it cannot). Appellants respectfully note that while the title of 
the listed publication mentions a MIB, the title of the publication does not teach or 
even suggest applying a MIB integrator to a MIB to identify data categories as 
required by claim 6. Because none of the cited art, either alone or together, and 
whether properly or improperly cited, teach or even suggest all of the limitations 
of dependent claim 6, Appellants respectfully submit that the claim is not obvious 
over the cited art. Appellants thus respectfully submit that at least for these 
reasons, and in addition to the reasons presented above with regard to claims 
2-6, the Examiner erred in rejecting dependent claim 6 under 35 U.S.C. § 103(a), 
and respectfully request reversal of the rejection of the claim. 

3. The § 103(a) Rejection of Independent Claim 7 
The Examiner rejected independent claim 7 on the same grounds as 
independent claim 1 . Appellants respectfully note that the limitations of claim 7 
are not the same as the limitations of claim 1 , and that at least some of the 
limitations of claim 7 are not addressed by any of the rejections of claim 1. 
Independent claim 7 requires a first and second network device, and a data 
parser that couples to both devices and has access to a first and second parser 
script. The parser script of claim 7 "is operable to produce categorized data from 
the data received from the first and second network components data interface 
operating with the first and second parser scripts, respectively." Appellants 
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respectfully note that Kouchi does not teach or even suggest parser scripts of any 
kind, and that Kennelly only teaches a single script that retrieves data from a 
single server to produce an HTIVIL web page displayed to a user in a web 
browser. Appellants thus respectfully submit that neither Kouchi nor Kennelly, 
either alone or together, teach or even suggest a single parser that produces 
categorized data based upon data received from two distinct network devices by 
operating two scripts, the first and second script respectively operating on the 
data from the first and second network device. 

For at least the reasons presented above, Appellants respectfully submit 
that none of the cited art, either alone or together, teaches or even suggests all of 
the limitations of independent claim 7, and thus the claim is not rendered obvious 
over the cited. Appellants therefore respectfully submit that the Examiner erred in 
rejecting independent claim 7 under 35 U.S.C. § 103(a), and respectfully request 
reversal of the rejection of the claim. 

4- The § 103(a) Rejections of Dependent Claims 8-18 

Regarding the rejection of dependent claims 8-18 as also allegedly 
obvious over Kouchi in view of Kennelly, Appellants respectfully note that 
because these claims include all of the limitations of, and depend upon, 
independent claim 7, and because none of the cited art, either alone or in 
conjunction with each other, teaches or even suggest all of the limitations of claim 
7, for at least the reasons presented above with regard to independent claim 7, 
dependent claims 8-18 are also not rendered obvious over the cited art. 
Appellants therefore respectfully submit that the Examiner erred in rejecting 
dependent claims 8-18 under 35 U.S.C. § 103(a), and respectfully request 
reversal of the rejection of these claims. 

5. The § 103(a) Rejection of Independent Claim 19 

The Examiner rejected independent claim 19 on the same grounds as 
independent claim 1. Appellants respectfully note that while claim 19 does 
include at least some of the limitations of claim 1, claim 19 also includes 
limitations similar to those of claim 7 {e.g., a plurality of network components 
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providing data respectively operated on by scripts from a plurality of scripts). 
Appellants thus respectfully submit that for at least reasons similar to those 
presented with regard to independent claim 7, none of the cited art, either alone 
or together, teaches or even suggests all of the limitations of independent claim 
19, and thus the claim is not rendered obvious over the cited art. 

Appellants further respectfully note that independent claim 1 9 also requires 
"storing the categorized and formatted data to a central data manager comprising 
a data storage device," and that this claim element is not addressed at all by the 
Examiner. Appellants thus respectfully submit that, for at least this reason, the 
Examiner has failed to show that Kouchi and Kennelly teach or even suggest all 
of the limitations of independent claim 19, and thus has failed to establish a prima 
facie case for obviousness under 35 U.S.C. § 1 03(a). 

For at least the reasons presented above. Appellants respectfully submit 
that none of the cited art, either alone or together, teaches or even suggests all of 
the limitations of independent claim 19, and thus the claim is not rendered 
obvious over the cited. Appellants therefore respectfully submit that the Examiner 
erred in rejecting independent claim 19 under 35 U.S.C. § 103(a), and 
respectfully request reversal of the rejection of the claim. 

6. The § 103(a) Rejections of Dependent Claims 20-26 

Regarding the rejection of dependent claims 20-26 as also allegedly 
obvious over Kouchi in view of Kennelly, Appellants respectfully note that 
because these claims include all of the limitations of, and depend upon, 
independent claim 19, and because none of the cited art, either alone or in 
conjunction with each other, teaches or even suggest all of the limitations of claim 
19, for at least the reasons presented above with regard to independent claim 19, 
dependent claims 20-26 are also not rendered obvious over the cited art. 
Appellants therefore respectfully submit that the Examiner erred in rejecting 
dependent claims 20-26 under 35 U.S.C. § 103(a), and respectfully request 
reversal of the rejection of these claims. 
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VIII. CONCLUSION 

For the reasons stated above, Appellants respectfully submit that the 
Examiner erred in rejecting claims 1-26 and that these claims are all in condition 
for allowance. Appellants thus respectfully request reversal of the rejections. It 
is believed that no extensions of time or fees are required, beyond those that 
may otherwise be provided for in documents accompanying this paper. 
However, in the event that additional extensions of time are necessary to allow 
consideration of this paper, such extensions are hereby petitioned under 37 
C.F.R. § 1.136(a), and any fees required (including fees for net addition of 
claims) are hereby authorized to be charged to Conley Rose, P.C.'s Deposit 
Account No. 03-2769/2416-00300. 

Respectfully submitted, 

/Roberto de Leon/ 
Roberto de Leon 
PTO Reg. No. 58,967 
CONLEY ROSE, P.C. 
(713) 238-8000 (Phone) 
(713) 238-8008 (Fax) 
ATTORNEY FOR APPELLANTS 
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IX. CLAIMS APPENDIX 

Claims on Appeal: 

1 . (Original) A method for compiling parser scripts each corresponding to the 
structure of security data received from a network component comprising the 
steps of: 

a) identifying sets of data categories, each set corresponding to security data 
received from one of a plurality of network components; 

b) constructing database record definitions, each defining a record 
subdivided in accordance with one of the sets of data categories; 

c) writing parser scripts that receive security data from the network 
components and output records, each record corresponding to one of the 
record definitions; and 

d) storing said parser scripts. 

2. (Original) The method of claim 1 further comprising the steps of: 

e) determining the format of each category in said sets; 

f) formatting the subdivisions to match the formats of the categories of the 
set to which the definition corresponds; and wherein each of the output 
records of step (c) correspond in format to one of the record definitions. 

3. (Original) The method of claim 1 further comprising the steps of: 

g) building database tables in a relational database each having the fields of 
one of the database record definitions; and 

h) inserting output records received from the parser scripts into the tables. 

4. (Original) The method of claim 2 further comprising the steps of: 

i) building database tables in a relational database each having the fields 
and formats of one of the database record definitions; and 
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j) inserting output records received from the data interface operating per 
defined data constructs into the tables. 

5. (Original) The method of claim 1 wherein: at least one of the sets of data 
categories is identified, at least in part, from the product specifications of the 
network components. 

6. (Original) The method of claim 1 wherein: at least one of the sets of data 
categories is identified, at least in part, by applying a Management Information 
Base (MIB) integrator to a Management Information Base for the corresponding 
network component. 

7. (Original) An information network security data compilation system, 
comprising: 

a) a first network component; 

b) a second network component; and 

c) a data parser coupled to the first and second network components having 
access to a first parser script and a second parser script, the data parser is 
operable to produce categorized data from the data received from the first 
and second network components data interface operating with the first and 
second parser scripts, respectively. 

8. (Original) The data compilation system of claim 7 wherein: 

a) the first network component is a firewall and 

b) the second network component is an intrusion detection system. 

9. (Original) The data compilation system of claim 7 further comprising: 

a) a third network component and 

b) a distributed data manager; and wherein: the data parser is coupled to the 
second and third network components through the distributed data 
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manager which collects and compresses data from the second and third 
network components and forwards the compressed data to the data 
parser. 

1 0. (Original) The data compilation system of claim 7 further comprising: 

a) a third network component; 

b) a second data parser coupled to the third component having access to a 
third parser script, the second data parser operable to produce categorized 
data from the data received from the third network component with the 
third parser script; and 

c) a relational database coupled to the first and second data parsers. 

1 1 . (Original) The data compilation system of claim 7 further comprising: 

a) a display coupled to the data parser; and 

b) a relational database coupled between the data parser and the display, 
and wherein: the data parser transfers the categorized data to the 
relational database. 

12. (Original) The data compilation system of claim 11 wherein: the relational 
database receives a data query, and the display shows a portion of the 
categorized data, up to and including all the data, from the relational database, 
corresponding to the data query. 

13. (Original) The data compilation system of claim 12 wherein: the data 
queries are submitted and the portions are shown through a web browser 
interface. 

14. (Original) The data compilation system of claim 7 further comprising: a) an 
event detector coupled to the data parser and wherein: the event detector 
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compares the categorized data to a predetermined event definition and provides 
a signal if a match is found. 

15. (Original) The data compilation system of claim 7 further comprising: a) an 
information technology agent and wherein: the network component is 
programmed by software, the agent collects security data from the software, and 
the data provided from the first network component is the security data collected 
by the agent. 

16. (Original) The data compilation system of claim 7 wherein: the data parser 
produces formatted and categorized data. 

17. (Original) The data compilation system of claim 7 wherein: data from the 
first network component is security data and data from the second network 
component is security data. 

18. (Original) The data compilation system of claim 7 wherein: data from the 
first network component is encrypted and decrypted. 

19. (Previously presented) A method of compiling network security data 
comprising the steps of: 

a) collecting security data from a plurality of network components; 

b) accessing a plurality of different parser scripts, each script corresponding 
to one of the network components; 

c) applying the plurality of different parser scripts to the security data to 
produce categorized and formatted data; and 

d) storing the categorized and formatted data to a central data manager 
comprising a data storage device. 
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20. (Original) The method of claim 19 wherein: the plurality of network 
components includes at least a firewall and an intrusion detection system. 

21 . (Original) The method of claim 1 9 further comprising the steps of: 

e) transmitting the categorized and formatted data to a relational database; 

f) providing a user interface for submitting queries to the relational database; 
and 

g) displaying the categorized and formatted data, or a subset thereof, in 
accordance with submitted queries. 

22. (Original) The method of claim 21 wherein: step (e) occurs prior to step (d) 
and step (d) comprises storing the categorized and formatted data in the 
relational database. 

23. (Original) The method of claim 19 further comprising the steps of: 

h) comparing the categorized and formatted data to at least one 
predetermined event definition; and 

i) generating a signal if the data matches at least one event definitions. 

24. (Original) The method of claim 19 wherein: one of the network 
components is programmed by software and an information technology agent 
communicates with the software to collect the security data. 

25. (Original) The method of claim 19 wherein: the step of collecting occurs in 
real time rather than in batches. 

26. (Original) The method of claim 19 wherein: at least two of the plurality of 
different data constructs correspond to the same network component. 
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X. EVIDENCE APPENDIX 

Not applicable in the present appeal. 
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XI. RELATED PROCEEDINGS APPENDIX 

Not applicable in the present appeal. 
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